Filtered by vendor Pimcore
Subscriptions
Total
148 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-0323 | 1 Pimcore | 1 Pimcore | 2025-04-07 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14. | ||||
| CVE-2024-25625 | 1 Pimcore | 1 Admin Classic Bundle | 2025-04-01 | 8.1 High |
| Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. A potential security vulnerability has been discovered in `pimcore/admin-ui-classic-bundle` prior to version 1.3.4. The vulnerability involves a Host Header Injection in the `invitationLinkAction` function of the UserController, specifically in the way `$loginUrl` trusts user input. The host header from incoming HTTP requests is used unsafely when generating URLs. An attacker can manipulate the HTTP host header in requests to the /admin/user/invitationlink endpoint, resulting in the generation of URLs with the attacker's domain. In fact, if a host header is injected in the POST request, the $loginURL parameter is constructed with this unvalidated host header. It is then used to send an invitation email to the provided user. This vulnerability can be used to perform phishing attacks by making the URLs in the invitation links emails point to an attacker-controlled domain. Version 1.3.4 contains a patch for the vulnerability. The maintainers recommend validating the host header and ensuring it matches the application's domain. It would also be beneficial to use a default trusted host or hostname if the incoming host header is not recognized or is absent. | ||||
| CVE-2023-25240 | 1 Pimcore | 1 Pimcore | 2025-03-21 | 8.8 High |
| An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. | ||||
| CVE-2023-0827 | 1 Pimcore | 1 Pimcore | 2025-03-20 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17. | ||||
| CVE-2023-1115 | 1 Pimcore | 1 Pimcore | 2025-03-11 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||||
| CVE-2023-23937 | 1 Pimcore | 1 Pimcore | 2025-03-10 | 8.2 High |
| Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature (p.e. GIF89) and sending any invalid content-type. This could allow an authenticated attacker to upload HTML files with JS content that will be executed in the context of the domain. This issue has been patched in version 10.5.16. | ||||
| CVE-2023-1067 | 1 Pimcore | 1 Pimcore | 2025-03-10 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||||
| CVE-2023-1116 | 1 Pimcore | 1 Pimcore | 2025-03-07 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||||
| CVE-2023-1117 | 1 Pimcore | 1 Pimcore | 2025-03-07 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18. | ||||
| CVE-2023-1286 | 1 Pimcore | 1 Pimcore | 2025-02-28 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-1312 | 1 Pimcore | 1 Pimcore | 2025-02-28 | 4.8 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-5873 | 1 Pimcore | 1 Pimcore | 2025-02-27 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0. | ||||
| CVE-2023-1429 | 1 Pimcore | 1 Pimcore | 2025-02-26 | 5.4 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-1515 | 1 Pimcore | 1 Pimcore | 2025-02-26 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-1517 | 1 Pimcore | 1 Pimcore | 2025-02-26 | 4.8 Medium |
| Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-1578 | 1 Pimcore | 1 Pimcore | 2025-02-25 | 8.8 High |
| SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. | ||||
| CVE-2023-28106 | 1 Pimcore | 1 Pimcore | 2025-02-25 | 6.1 Medium |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.19, an attacker can use cross-site scripting to send a malicious script to an unsuspecting user. Users may upgrade to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually. | ||||
| CVE-2023-28108 | 1 Pimcore | 1 Pimcore | 2025-02-25 | 7.9 High |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.19, quoting is not done properly in UUID DAO model. There is the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class. Users should update to version 10.5.19 to receive a patch or, as a workaround, apply the patch manually. | ||||
| CVE-2023-28429 | 1 Pimcore | 1 Pimcore | 2025-02-25 | 6.1 Medium |
| Pimcore is an open source data and experience management platform. Versions prior to 10.5.19 have an unsecured tooltip field in DataObject class definition. This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Users should upgrade to version 10.5.19 or, as a workaround, apply the patch manually. | ||||
| CVE-2023-28438 | 1 Pimcore | 1 Pimcore | 2025-02-25 | 6.2 Medium |
| Pimcore is an open source data and experience management platform. Prior to version 10.5.19, since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link. Users should upgrade to version 10.5.19 to receive a patch or, as a workaround, may apply the patch manually. | ||||